VARIoT IoT vulnerabilities database

Affected products: vendor, model and version
CWE format is 'CWE-number'. Threat type can be: remote or local
Look up free text in title and description

VAR-200507-0107 CVE-2005-2105 Cisco IOS of AAA Avoiding authentication in authentication services Vulnerabilities CVSS V2: 7.5
CVSS V3: -
Severity: HIGH
Cisco IOS 12.2T through 12.4 allows remote attackers to bypass Authentication, Authorization, and Accounting (AAA) RADIUS authentication, if the fallback method is set to none, via a long username. A remote attacker may exploit this issue to bypass authentication and gain unauthorized access to the affected service. Cisco IOS is the underlying system used by Cisco devices
VAR-200507-0043 CVE-2005-2136 Raritan DominionSX ConsoleServer Weak security mechanism vulnerability CVSS V2: 4.6
CVSS V3: -
Severity: MEDIUM
Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 set (1) world-readable permissions for /etc/shadow and (2) world-writable permissions for /bin/busybox, which allows local users to obtain hashed passwords or execute arbitrary code as other users. Raritan Dominion SX is reportedly prone to multiple vulnerabilities. Reportedly, the server contains two default accounts that are not protected with a password. This can allow a remote attacker to gain unauthorized access to the server. Another issue can allow an attacker to potentially gain elevated privileges on an affected computer as the shadow password file is world readable. Raritan Dominion SX16, SX32, SX4, SX8, and SXA-48 are reportedly vulnerable. The researcher responsible for reporting these issues has stated that DSX32 running firmware version 2.4.6 was tested and is vulnerable to these issues. This BID will be updated when more details are available. Raritan Dominion SX Console Server is a set of serial device management software. Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 have weak security mechanisms. ---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: Dominion SX Insecure File Permission Security Issues SECUNIA ADVISORY ID: SA15853 VERIFY ADVISORY: http://secunia.com/advisories/15853/ CRITICAL: Less critical IMPACT: Manipulation of data, Exposure of sensitive information WHERE: Local system OPERATING SYSTEM: Dominion SX http://secunia.com/product/5300/ DESCRIPTION: Dirk Wetter has reported two security issues in Dominion SX, which can be exploited by malicious, local users to disclose sensitive information, cause a DoS (Denial of Service), and potentially gain escalated privileges. 1) The default file permission of "/etc/shadow" is set to world-readable, which makes it possible to gain knowledge of the root user's password hash. 2) The default file permission of "/bin/busybox" is set to world-writable. This can be exploited to move or delete the file and potentially execute arbitrary code with another user's privileges by replacing it with a malicious file. The security issues have been reported in DSX4, DSX8, DSX16, DSX32, and DSXA-48. SOLUTION: Apply updated firmware. http://www.raritan.com/support/sup_upgrades.aspx PROVIDED AND/OR DISCOVERED BY: Dirk Wetter ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
VAR-200510-0293 CVE-2005-2524 Ruby library contains vulnerable default value CVSS V2: 5.0
CVSS V3: -
Severity: MEDIUM
Safari after 2.0 in Apple Mac OS X 10.3.9 allows remote attackers to bypass domain restrictions via crafted web archives that cause Safari to render them as if they came from a different site. Ruby includes a vulnerable default value that may be used to bypass security restrictions and execute arbitrary code. Apple Mac OS X QuickDraw Manager contains a buffer overflow that may allow a remote attacker to execute arbitrary code. Two vulnerabilities in Mail resulting in information disclosure. A local privilege escalation vulnerability in malloc. This issue has been split into BID 14939. An arbitrary code execution vulnerability in QuickDraw Manager. A privilege escalation vulnerability in QuickTime for Java. A cross-site scripting vulnerability in Safari. An unauthorized access vulnerability in SecurityAgent. A privilege escalation vulnerability in securityd. Safari is Apple's Safari web browser compatible with Microsoft Windows operating system. 1) A boundary error in ImageIO can be exploited to cause a buffer overflow and may allow execution of arbitrary code on a user's system when a specially crafted GIF file is opened e.g. in WebCore or Safari. 2) An error in Mail.app when processing auto-reply rules can cause an automatically generated response message to include a plain-text copy of the encrypted message. This may disclose certain sensitive information. 3) An error in Mail.app when using Kerberos 5 for SMTP authentication can cause un-initialized memory to be appended to a message. This may disclose certain sensitive information. For more information: SA16449 4) "malloc" creates diagnostic files insecurely when certain environmental variables are set to enable debugging of application memory allocation. This can be exploited by malicious, local users to create or overwrite arbitrary files. from Safari, Mail, or Finder. 6) A validation error in the Java extensions bundled with QuickTime 6.52 and earlier can be exploited by untrusted applets to call arbitrary functions from system libraries. Systems with QuickTime 7 or later, or Mac OS X v10.4 or later, are not affected. Systems prior to Mac OS X v10.4 are not affected. For more information: SA15767 8) A validation error in Safari when rendering web archives from a malicious site can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of another site. For more information: SA16449 9) An error in the SecurityAgent may cause the "Switch User..." button to be displayed even when the "Enable fast user switching" setting has been disabled. This may allow malicious, local users to access the current user's desktop without authentication even when the "Require password to wake this computer from sleep or screen saver" setting is enabled. 10) A validation error in the Authorization Services "securityd" allows unprivileged users to gain certain privileges that should be restricted to administrative users. This can be exploited by malicious, local users to gain escalated privileges. SOLUTION: Apply Security Update 2005-008. Mac OS X 10.3.9: http://www.apple.com/support/downloads/securityupdate2005008macosx1039.html Mac OS X 10.4.2: http://www.apple.com/support/downloads/securityupdate2005008macosx1042.html PROVIDED AND/OR DISCOVERED BY: 2) Norbert Rittel, Rittel Consulting 3) MIT Kerberos Team 4) Ilja van Sprundel, Suresec LTD 5) Henrik Dalgaard, Echo One 6) Dino Dai Zovi 9) Luke Fowler, Indiana University Global Research Network Operations Center ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=302413 OTHER REFERENCES: SA15767: http://secunia.com/advisories/15767/ SA16449: http://secunia.com/advisories/16449/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . The vulnerability is caused due to an unspecified error in the XMLRPC module, which may be exploited to execute arbitrary commands on a vulnerable XMLRPC server. The vulnerability has been reported in version 1.8.2. Prior versions may also be affected. SOLUTION: The vulnerability has been fixed in the CVS repository
VAR-200510-0138 CVE-2005-2743 Ruby library contains vulnerable default value CVSS V2: 7.5
CVSS V3: -
Severity: HIGH
The Java extensions for QuickTime 6.52 and earlier in Apple Mac OS X 10.3.9 allow untrusted applets to call arbitrary functions in system libraries, which allows remote attackers to execute arbitrary code. Ruby includes a vulnerable default value that may be used to bypass security restrictions and execute arbitrary code. Two vulnerabilities in Mail resulting in information disclosure. A local privilege escalation vulnerability in malloc. This issue has been split into BID 14939. An arbitrary code execution vulnerability in QuickDraw Manager. A privilege escalation vulnerability in QuickTime for Java. A cross-site scripting vulnerability in Safari. An unauthorized access vulnerability in SecurityAgent. A privilege escalation vulnerability in securityd. Mac OS is an operating system running on Apple Macintosh series computers. 1) A boundary error in ImageIO can be exploited to cause a buffer overflow and may allow execution of arbitrary code on a user's system when a specially crafted GIF file is opened e.g. in WebCore or Safari. 2) An error in Mail.app when processing auto-reply rules can cause an automatically generated response message to include a plain-text copy of the encrypted message. This may disclose certain sensitive information. 3) An error in Mail.app when using Kerberos 5 for SMTP authentication can cause un-initialized memory to be appended to a message. This may disclose certain sensitive information. For more information: SA16449 4) "malloc" creates diagnostic files insecurely when certain environmental variables are set to enable debugging of application memory allocation. This can be exploited by malicious, local users to create or overwrite arbitrary files. from Safari, Mail, or Finder. Systems with QuickTime 7 or later, or Mac OS X v10.4 or later, are not affected. Systems prior to Mac OS X v10.4 are not affected. For more information: SA15767 8) A validation error in Safari when rendering web archives from a malicious site can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of another site. For more information: SA16449 9) An error in the SecurityAgent may cause the "Switch User..." button to be displayed even when the "Enable fast user switching" setting has been disabled. This may allow malicious, local users to access the current user's desktop without authentication even when the "Require password to wake this computer from sleep or screen saver" setting is enabled. 10) A validation error in the Authorization Services "securityd" allows unprivileged users to gain certain privileges that should be restricted to administrative users. This can be exploited by malicious, local users to gain escalated privileges. SOLUTION: Apply Security Update 2005-008. Mac OS X 10.3.9: http://www.apple.com/support/downloads/securityupdate2005008macosx1039.html Mac OS X 10.4.2: http://www.apple.com/support/downloads/securityupdate2005008macosx1042.html PROVIDED AND/OR DISCOVERED BY: 2) Norbert Rittel, Rittel Consulting 3) MIT Kerberos Team 4) Ilja van Sprundel, Suresec LTD 5) Henrik Dalgaard, Echo One 6) Dino Dai Zovi 9) Luke Fowler, Indiana University Global Research Network Operations Center ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=302413 OTHER REFERENCES: SA15767: http://secunia.com/advisories/15767/ SA16449: http://secunia.com/advisories/16449/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . The vulnerability is caused due to an unspecified error in the XMLRPC module, which may be exploited to execute arbitrary commands on a vulnerable XMLRPC server. The vulnerability has been reported in version 1.8.2. Prior versions may also be affected. SOLUTION: The vulnerability has been fixed in the CVS repository
VAR-200510-0142 CVE-2005-2747 Ruby library contains vulnerable default value CVSS V2: 7.5
CVSS V3: -
Severity: HIGH
Buffer overflow in ImageIO for Apple Mac OS X 10.4.2, as used by applications such as WebCore and Safari, allows remote attackers to execute arbitrary code via a crafted GIF file. Ruby includes a vulnerable default value that may be used to bypass security restrictions and execute arbitrary code. Two vulnerabilities in Mail resulting in information disclosure. A local privilege escalation vulnerability in malloc. This issue has been split into BID 14939. An arbitrary code execution vulnerability in QuickDraw Manager. A privilege escalation vulnerability in QuickTime for Java. A cross-site scripting vulnerability in Safari. An unauthorized access vulnerability in SecurityAgent. A privilege escalation vulnerability in securityd. in WebCore or Safari. 2) An error in Mail.app when processing auto-reply rules can cause an automatically generated response message to include a plain-text copy of the encrypted message. This may disclose certain sensitive information. 3) An error in Mail.app when using Kerberos 5 for SMTP authentication can cause un-initialized memory to be appended to a message. This may disclose certain sensitive information. For more information: SA16449 4) "malloc" creates diagnostic files insecurely when certain environmental variables are set to enable debugging of application memory allocation. This can be exploited by malicious, local users to create or overwrite arbitrary files. from Safari, Mail, or Finder. 6) A validation error in the Java extensions bundled with QuickTime 6.52 and earlier can be exploited by untrusted applets to call arbitrary functions from system libraries. Systems with QuickTime 7 or later, or Mac OS X v10.4 or later, are not affected. Systems prior to Mac OS X v10.4 are not affected. For more information: SA15767 8) A validation error in Safari when rendering web archives from a malicious site can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of another site. For more information: SA16449 9) An error in the SecurityAgent may cause the "Switch User..." button to be displayed even when the "Enable fast user switching" setting has been disabled. This may allow malicious, local users to access the current user's desktop without authentication even when the "Require password to wake this computer from sleep or screen saver" setting is enabled. 10) A validation error in the Authorization Services "securityd" allows unprivileged users to gain certain privileges that should be restricted to administrative users. This can be exploited by malicious, local users to gain escalated privileges. SOLUTION: Apply Security Update 2005-008. Mac OS X 10.3.9: http://www.apple.com/support/downloads/securityupdate2005008macosx1039.html Mac OS X 10.4.2: http://www.apple.com/support/downloads/securityupdate2005008macosx1042.html PROVIDED AND/OR DISCOVERED BY: 2) Norbert Rittel, Rittel Consulting 3) MIT Kerberos Team 4) Ilja van Sprundel, Suresec LTD 5) Henrik Dalgaard, Echo One 6) Dino Dai Zovi 9) Luke Fowler, Indiana University Global Research Network Operations Center ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=302413 OTHER REFERENCES: SA15767: http://secunia.com/advisories/15767/ SA16449: http://secunia.com/advisories/16449/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . The vulnerability is caused due to an unspecified error in the XMLRPC module, which may be exploited to execute arbitrary commands on a vulnerable XMLRPC server. The vulnerability has been reported in version 1.8.2. Prior versions may also be affected. SOLUTION: The vulnerability has been fixed in the CVS repository
VAR-200510-0141 CVE-2005-2746 Ruby library contains vulnerable default value CVSS V2: 5.0
CVSS V3: -
Severity: MEDIUM
Mail.app in Mail for Apple Mac OS X 10.3.9 and 10.4.2 includes message contents when using auto-reply rules, which could cause Mail.app to include decrypted message contents for encrypted messages. Ruby includes a vulnerable default value that may be used to bypass security restrictions and execute arbitrary code. Apple Mac OS X QuickDraw Manager contains a buffer overflow that may allow a remote attacker to execute arbitrary code. Two vulnerabilities in Mail resulting in information disclosure. A local privilege escalation vulnerability in malloc. This issue has been split into BID 14939. An arbitrary code execution vulnerability in QuickDraw Manager. A privilege escalation vulnerability in QuickTime for Java. A cross-site scripting vulnerability in Safari. An unauthorized access vulnerability in SecurityAgent. A privilege escalation vulnerability in securityd. Mac OS is an operating system running on Apple Macintosh series computers. 1) A boundary error in ImageIO can be exploited to cause a buffer overflow and may allow execution of arbitrary code on a user's system when a specially crafted GIF file is opened e.g. in WebCore or Safari. This may disclose certain sensitive information. 3) An error in Mail.app when using Kerberos 5 for SMTP authentication can cause un-initialized memory to be appended to a message. This may disclose certain sensitive information. For more information: SA16449 4) "malloc" creates diagnostic files insecurely when certain environmental variables are set to enable debugging of application memory allocation. This can be exploited by malicious, local users to create or overwrite arbitrary files. from Safari, Mail, or Finder. 6) A validation error in the Java extensions bundled with QuickTime 6.52 and earlier can be exploited by untrusted applets to call arbitrary functions from system libraries. Systems with QuickTime 7 or later, or Mac OS X v10.4 or later, are not affected. Systems prior to Mac OS X v10.4 are not affected. For more information: SA15767 8) A validation error in Safari when rendering web archives from a malicious site can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of another site. For more information: SA16449 9) An error in the SecurityAgent may cause the "Switch User..." button to be displayed even when the "Enable fast user switching" setting has been disabled. This may allow malicious, local users to access the current user's desktop without authentication even when the "Require password to wake this computer from sleep or screen saver" setting is enabled. 10) A validation error in the Authorization Services "securityd" allows unprivileged users to gain certain privileges that should be restricted to administrative users. This can be exploited by malicious, local users to gain escalated privileges. SOLUTION: Apply Security Update 2005-008. Mac OS X 10.3.9: http://www.apple.com/support/downloads/securityupdate2005008macosx1039.html Mac OS X 10.4.2: http://www.apple.com/support/downloads/securityupdate2005008macosx1042.html PROVIDED AND/OR DISCOVERED BY: 2) Norbert Rittel, Rittel Consulting 3) MIT Kerberos Team 4) Ilja van Sprundel, Suresec LTD 5) Henrik Dalgaard, Echo One 6) Dino Dai Zovi 9) Luke Fowler, Indiana University Global Research Network Operations Center ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=302413 OTHER REFERENCES: SA15767: http://secunia.com/advisories/15767/ SA16449: http://secunia.com/advisories/16449/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . The vulnerability is caused due to an unspecified error in the XMLRPC module, which may be exploited to execute arbitrary commands on a vulnerable XMLRPC server. The vulnerability has been reported in version 1.8.2. Prior versions may also be affected. SOLUTION: The vulnerability has been fixed in the CVS repository
VAR-200510-0131 CVE-2005-2748 Apple Mac OS X MallocStackLogging Local Arbitrary File Modification Vulnerability CVSS V2: 2.1
CVSS V3: -
Severity: LOW
The malloc function in the libSystem library in Apple Mac OS X 10.3.9 and 10.4.2 allows local users to overwrite arbitrary files by setting the MallocLogFile environment variable to the target file before running a setuid application. Ruby includes a vulnerable default value that may be used to bypass security restrictions and execute arbitrary code. Apple Mac OS X QuickDraw Manager contains a buffer overflow that may allow a remote attacker to execute arbitrary code. Two vulnerabilities in Mail resulting in information disclosure. A local privilege escalation vulnerability in malloc. This issue has been split into BID 14939. An arbitrary code execution vulnerability in QuickDraw Manager. A privilege escalation vulnerability in QuickTime for Java. A cross-site scripting vulnerability in Safari. An unauthorized access vulnerability in SecurityAgent. A privilege escalation vulnerability in securityd. This issue is due to insecure file handling in the 'malloc()' library for setuid applications. This issue occurs due to insufficient checks in the memory allocation library, leading to local users being able to utilize the debugging features on setuid applications. A local attacker could exploit this vulnerability to create, or append data to arbitrary files with superuser privileges. Depending on the purpose of the modified files, this may cause system crashes, or allow attackers to gain elevated privileges. 1) A boundary error in ImageIO can be exploited to cause a buffer overflow and may allow execution of arbitrary code on a user's system when a specially crafted GIF file is opened e.g. in WebCore or Safari. 2) An error in Mail.app when processing auto-reply rules can cause an automatically generated response message to include a plain-text copy of the encrypted message. This may disclose certain sensitive information. 3) An error in Mail.app when using Kerberos 5 for SMTP authentication can cause un-initialized memory to be appended to a message. This may disclose certain sensitive information. For more information: SA16449 4) "malloc" creates diagnostic files insecurely when certain environmental variables are set to enable debugging of application memory allocation. from Safari, Mail, or Finder. 6) A validation error in the Java extensions bundled with QuickTime 6.52 and earlier can be exploited by untrusted applets to call arbitrary functions from system libraries. For more information: SA15767 8) A validation error in Safari when rendering web archives from a malicious site can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of another site. For more information: SA16449 9) An error in the SecurityAgent may cause the "Switch User..." button to be displayed even when the "Enable fast user switching" setting has been disabled. This may allow malicious, local users to access the current user's desktop without authentication even when the "Require password to wake this computer from sleep or screen saver" setting is enabled. 10) A validation error in the Authorization Services "securityd" allows unprivileged users to gain certain privileges that should be restricted to administrative users. This can be exploited by malicious, local users to gain escalated privileges. SOLUTION: Apply Security Update 2005-008. Mac OS X 10.3.9: http://www.apple.com/support/downloads/securityupdate2005008macosx1039.html Mac OS X 10.4.2: http://www.apple.com/support/downloads/securityupdate2005008macosx1042.html PROVIDED AND/OR DISCOVERED BY: 2) Norbert Rittel, Rittel Consulting 3) MIT Kerberos Team 4) Ilja van Sprundel, Suresec LTD 5) Henrik Dalgaard, Echo One 6) Dino Dai Zovi 9) Luke Fowler, Indiana University Global Research Network Operations Center ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=302413 OTHER REFERENCES: SA15767: http://secunia.com/advisories/15767/ SA16449: http://secunia.com/advisories/16449/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . The vulnerability is caused due to an unspecified error in the XMLRPC module, which may be exploited to execute arbitrary commands on a vulnerable XMLRPC server. The vulnerability has been reported in version 1.8.2. Prior versions may also be affected. SOLUTION: The vulnerability has been fixed in the CVS repository
VAR-200510-0139 CVE-2005-2744 Ruby library contains vulnerable default value CVSS V2: 5.1
CVSS V3: -
Severity: MEDIUM
Buffer overflow in QuickDraw Manager for Apple OS X 10.3.9 and 10.4.2, as used by applications such as Safari, Mail, and Finder, allows remote attackers to execute arbitrary code via a crafted PICT file. Ruby includes a vulnerable default value that may be used to bypass security restrictions and execute arbitrary code. Two vulnerabilities in Mail resulting in information disclosure. A local privilege escalation vulnerability in malloc. This issue has been split into BID 14939. An arbitrary code execution vulnerability in QuickDraw Manager. A privilege escalation vulnerability in QuickTime for Java. A cross-site scripting vulnerability in Safari. An unauthorized access vulnerability in SecurityAgent. A privilege escalation vulnerability in securityd. QuicDraw is a graphics drawing platform in Apple OS. in WebCore or Safari. 2) An error in Mail.app when processing auto-reply rules can cause an automatically generated response message to include a plain-text copy of the encrypted message. This may disclose certain sensitive information. 3) An error in Mail.app when using Kerberos 5 for SMTP authentication can cause un-initialized memory to be appended to a message. This may disclose certain sensitive information. For more information: SA16449 4) "malloc" creates diagnostic files insecurely when certain environmental variables are set to enable debugging of application memory allocation. This can be exploited by malicious, local users to create or overwrite arbitrary files. from Safari, Mail, or Finder. 6) A validation error in the Java extensions bundled with QuickTime 6.52 and earlier can be exploited by untrusted applets to call arbitrary functions from system libraries. Systems with QuickTime 7 or later, or Mac OS X v10.4 or later, are not affected. Systems prior to Mac OS X v10.4 are not affected. For more information: SA15767 8) A validation error in Safari when rendering web archives from a malicious site can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of another site. For more information: SA16449 9) An error in the SecurityAgent may cause the "Switch User..." button to be displayed even when the "Enable fast user switching" setting has been disabled. This may allow malicious, local users to access the current user's desktop without authentication even when the "Require password to wake this computer from sleep or screen saver" setting is enabled. 10) A validation error in the Authorization Services "securityd" allows unprivileged users to gain certain privileges that should be restricted to administrative users. This can be exploited by malicious, local users to gain escalated privileges. SOLUTION: Apply Security Update 2005-008. Mac OS X 10.3.9: http://www.apple.com/support/downloads/securityupdate2005008macosx1039.html Mac OS X 10.4.2: http://www.apple.com/support/downloads/securityupdate2005008macosx1042.html PROVIDED AND/OR DISCOVERED BY: 2) Norbert Rittel, Rittel Consulting 3) MIT Kerberos Team 4) Ilja van Sprundel, Suresec LTD 5) Henrik Dalgaard, Echo One 6) Dino Dai Zovi 9) Luke Fowler, Indiana University Global Research Network Operations Center ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=302413 OTHER REFERENCES: SA15767: http://secunia.com/advisories/15767/ SA16449: http://secunia.com/advisories/16449/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . The vulnerability is caused due to an unspecified error in the XMLRPC module, which may be exploited to execute arbitrary commands on a vulnerable XMLRPC server. The vulnerability has been reported in version 1.8.2. Prior versions may also be affected. SOLUTION: The vulnerability has been fixed in the CVS repository
VAR-200510-0140 CVE-2005-2745 Ruby library contains vulnerable default value CVSS V2: 5.0
CVSS V3: -
Severity: MEDIUM
Mail.app in Mail for Apple Mac OS X 10.3.9, when using Kerberos 5 for SMTP authentication, can include uninitialized memory in a message, which might allow remote attackers to obtain sensitive information. Ruby includes a vulnerable default value that may be used to bypass security restrictions and execute arbitrary code. Two vulnerabilities in Mail resulting in information disclosure. A local privilege escalation vulnerability in malloc. This issue has been split into BID 14939. An arbitrary code execution vulnerability in QuickDraw Manager. A privilege escalation vulnerability in QuickTime for Java. A cross-site scripting vulnerability in Safari. An unauthorized access vulnerability in SecurityAgent. A privilege escalation vulnerability in securityd. Mac OS is an operating system that runs on Apple's Macintosh series of computers. 1) A boundary error in ImageIO can be exploited to cause a buffer overflow and may allow execution of arbitrary code on a user's system when a specially crafted GIF file is opened e.g. in WebCore or Safari. 2) An error in Mail.app when processing auto-reply rules can cause an automatically generated response message to include a plain-text copy of the encrypted message. This may disclose certain sensitive information. 3) An error in Mail.app when using Kerberos 5 for SMTP authentication can cause un-initialized memory to be appended to a message. This may disclose certain sensitive information. For more information: SA16449 4) "malloc" creates diagnostic files insecurely when certain environmental variables are set to enable debugging of application memory allocation. This can be exploited by malicious, local users to create or overwrite arbitrary files. from Safari, Mail, or Finder. 6) A validation error in the Java extensions bundled with QuickTime 6.52 and earlier can be exploited by untrusted applets to call arbitrary functions from system libraries. Systems with QuickTime 7 or later, or Mac OS X v10.4 or later, are not affected. Systems prior to Mac OS X v10.4 are not affected. For more information: SA15767 8) A validation error in Safari when rendering web archives from a malicious site can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of another site. For more information: SA16449 9) An error in the SecurityAgent may cause the "Switch User..." button to be displayed even when the "Enable fast user switching" setting has been disabled. This may allow malicious, local users to access the current user's desktop without authentication even when the "Require password to wake this computer from sleep or screen saver" setting is enabled. 10) A validation error in the Authorization Services "securityd" allows unprivileged users to gain certain privileges that should be restricted to administrative users. This can be exploited by malicious, local users to gain escalated privileges. SOLUTION: Apply Security Update 2005-008. Mac OS X 10.3.9: http://www.apple.com/support/downloads/securityupdate2005008macosx1039.html Mac OS X 10.4.2: http://www.apple.com/support/downloads/securityupdate2005008macosx1042.html PROVIDED AND/OR DISCOVERED BY: 2) Norbert Rittel, Rittel Consulting 3) MIT Kerberos Team 4) Ilja van Sprundel, Suresec LTD 5) Henrik Dalgaard, Echo One 6) Dino Dai Zovi 9) Luke Fowler, Indiana University Global Research Network Operations Center ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=302413 OTHER REFERENCES: SA15767: http://secunia.com/advisories/15767/ SA16449: http://secunia.com/advisories/16449/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . The vulnerability is caused due to an unspecified error in the XMLRPC module, which may be exploited to execute arbitrary commands on a vulnerable XMLRPC server. The vulnerability has been reported in version 1.8.2. Prior versions may also be affected. SOLUTION: The vulnerability has been fixed in the CVS repository
VAR-200510-0137 CVE-2005-2742 Ruby library contains vulnerable default value CVSS V2: 4.6
CVSS V3: -
Severity: MEDIUM
SecurityAgent in Apple Mac OS X 10.4.2, under certain circumstances, can cause the "Switch User..." button to appear even though the "Enable fast user switching" setting is disabled, which can allow attackers with physical access to gain access to the desktop and bypass the "Require password to wake this computer from sleep or screen saver" setting. Ruby includes a vulnerable default value that may be used to bypass security restrictions and execute arbitrary code. Apple Mac OS X QuickDraw Manager contains a buffer overflow that may allow a remote attacker to execute arbitrary code. Two vulnerabilities in Mail resulting in information disclosure. A local privilege escalation vulnerability in malloc. This issue has been split into BID 14939. An arbitrary code execution vulnerability in QuickDraw Manager. A privilege escalation vulnerability in QuickTime for Java. A cross-site scripting vulnerability in Safari. An unauthorized access vulnerability in SecurityAgent. A privilege escalation vulnerability in securityd. Security Agent is a powerful system security auxiliary tool in the Apple system. 1) A boundary error in ImageIO can be exploited to cause a buffer overflow and may allow execution of arbitrary code on a user's system when a specially crafted GIF file is opened e.g. in WebCore or Safari. 2) An error in Mail.app when processing auto-reply rules can cause an automatically generated response message to include a plain-text copy of the encrypted message. This may disclose certain sensitive information. 3) An error in Mail.app when using Kerberos 5 for SMTP authentication can cause un-initialized memory to be appended to a message. This may disclose certain sensitive information. For more information: SA16449 4) "malloc" creates diagnostic files insecurely when certain environmental variables are set to enable debugging of application memory allocation. This can be exploited by malicious, local users to create or overwrite arbitrary files. from Safari, Mail, or Finder. 6) A validation error in the Java extensions bundled with QuickTime 6.52 and earlier can be exploited by untrusted applets to call arbitrary functions from system libraries. Systems with QuickTime 7 or later, or Mac OS X v10.4 or later, are not affected. Systems prior to Mac OS X v10.4 are not affected. For more information: SA15767 8) A validation error in Safari when rendering web archives from a malicious site can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of another site. 10) A validation error in the Authorization Services "securityd" allows unprivileged users to gain certain privileges that should be restricted to administrative users. This can be exploited by malicious, local users to gain escalated privileges. SOLUTION: Apply Security Update 2005-008. Mac OS X 10.3.9: http://www.apple.com/support/downloads/securityupdate2005008macosx1039.html Mac OS X 10.4.2: http://www.apple.com/support/downloads/securityupdate2005008macosx1042.html PROVIDED AND/OR DISCOVERED BY: 2) Norbert Rittel, Rittel Consulting 3) MIT Kerberos Team 4) Ilja van Sprundel, Suresec LTD 5) Henrik Dalgaard, Echo One 6) Dino Dai Zovi 9) Luke Fowler, Indiana University Global Research Network Operations Center ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=302413 OTHER REFERENCES: SA15767: http://secunia.com/advisories/15767/ SA16449: http://secunia.com/advisories/16449/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . The vulnerability is caused due to an unspecified error in the XMLRPC module, which may be exploited to execute arbitrary commands on a vulnerable XMLRPC server. The vulnerability has been reported in version 1.8.2. Prior versions may also be affected. SOLUTION: The vulnerability has been fixed in the CVS repository
VAR-200510-0136 CVE-2005-2741 Ruby library contains vulnerable default value CVSS V2: 7.2
CVSS V3: -
Severity: HIGH
Authorization Services in securityd for Apple Mac OS X 10.3.9 allows local users to gain privileges by granting themselves certain rights that should be restricted to administrators. Ruby includes a vulnerable default value that may be used to bypass security restrictions and execute arbitrary code. Apple Mac OS X QuickDraw Manager contains a buffer overflow that may allow a remote attacker to execute arbitrary code. Two vulnerabilities in Mail resulting in information disclosure. A local privilege escalation vulnerability in malloc. This issue has been split into BID 14939. An arbitrary code execution vulnerability in QuickDraw Manager. A privilege escalation vulnerability in QuickTime for Java. A cross-site scripting vulnerability in Safari. An unauthorized access vulnerability in SecurityAgent. A privilege escalation vulnerability in securityd. Mac OS is an operating system running on Apple Macintosh series computers. 1) A boundary error in ImageIO can be exploited to cause a buffer overflow and may allow execution of arbitrary code on a user's system when a specially crafted GIF file is opened e.g. in WebCore or Safari. 2) An error in Mail.app when processing auto-reply rules can cause an automatically generated response message to include a plain-text copy of the encrypted message. This may disclose certain sensitive information. 3) An error in Mail.app when using Kerberos 5 for SMTP authentication can cause un-initialized memory to be appended to a message. This may disclose certain sensitive information. For more information: SA16449 4) "malloc" creates diagnostic files insecurely when certain environmental variables are set to enable debugging of application memory allocation. This can be exploited by malicious, local users to create or overwrite arbitrary files. from Safari, Mail, or Finder. 6) A validation error in the Java extensions bundled with QuickTime 6.52 and earlier can be exploited by untrusted applets to call arbitrary functions from system libraries. Systems with QuickTime 7 or later, or Mac OS X v10.4 or later, are not affected. Systems prior to Mac OS X v10.4 are not affected. For more information: SA15767 8) A validation error in Safari when rendering web archives from a malicious site can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of another site. For more information: SA16449 9) An error in the SecurityAgent may cause the "Switch User..." button to be displayed even when the "Enable fast user switching" setting has been disabled. This may allow malicious, local users to access the current user's desktop without authentication even when the "Require password to wake this computer from sleep or screen saver" setting is enabled. This can be exploited by malicious, local users to gain escalated privileges. SOLUTION: Apply Security Update 2005-008. Mac OS X 10.3.9: http://www.apple.com/support/downloads/securityupdate2005008macosx1039.html Mac OS X 10.4.2: http://www.apple.com/support/downloads/securityupdate2005008macosx1042.html PROVIDED AND/OR DISCOVERED BY: 2) Norbert Rittel, Rittel Consulting 3) MIT Kerberos Team 4) Ilja van Sprundel, Suresec LTD 5) Henrik Dalgaard, Echo One 6) Dino Dai Zovi 9) Luke Fowler, Indiana University Global Research Network Operations Center ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=302413 OTHER REFERENCES: SA15767: http://secunia.com/advisories/15767/ SA16449: http://secunia.com/advisories/16449/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . The vulnerability is caused due to an unspecified error in the XMLRPC module, which may be exploited to execute arbitrary commands on a vulnerable XMLRPC server. The vulnerability has been reported in version 1.8.2. Prior versions may also be affected. SOLUTION: The vulnerability has been fixed in the CVS repository
VAR-200506-0244 CVE-2005-1250 Ipswitch WhatsUp Professional 'login.asp' SQL Injection vulnerability CVSS V2: 7.5
CVSS V3: -
Severity: HIGH
SQL injection vulnerability in the logon screen of the web front end (NmConsole/Login.asp) for IpSwitch WhatsUp Professional 2005 SP1 allows remote attackers to execute arbitrary SQL commands via the (1) User Name field (sUserName parameter) or (2) Password (sPassword parameter). This issue is due to a failure in the application to properly sanitize user-supplied input to the 'login.asp' script before using it in an SQL query. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. It should be noted that by supplying a 'or' value through the 'password' parameter, an attacker can gain unauthorized access to an affected site. WhatsUp Professional is a network management solution for SMBs
VAR-200512-0626 CVE-2005-2757 Mac OS X and OS X Server CoreFoundation Heap buffer overflow vulnerability CVSS V2: 7.5
CVSS V3: -
Severity: HIGH
Heap-based buffer overflow in CoreFoundation in Mac OS X and OS X Server 10.4 through 10.4.3 allows remote attackers to execute arbitrary code via unknown attack vectors involving "validation of URLs.". CoreFoundation is prone to a buffer-overflow vulnerability. The issue presents itself when specially crafted URIs are handled. A successful attack may result in a denial-of-service condition or remote unauthorized access because of arbitrary code execution in the context of the affected application. NOTE: This issue was previously discussed in BID 15647 (Apple Mac OS X Security Update 2005-009 Multiple Vulnerabilities), but has been assigned its own record to better document the vulnerability. For more information: SA14530 2) An error in the Apache web server's "mod_ssl" module may be exploited by malicious people to bypass certain security restrictions. For more information: SA16700 3) A boundary error exists in CoreFoundation when resolving certain URL. 4) An error in curl when handling NTLM authentication can be exploited by malicious people to compromise a user's system. For more information: SA17193 5) An error exists in the ODBC Administrator utility helper tool "iodbcadmintoo". 6) An error in OpenSSL when handling certain compatibility options can potentially be exploited by malicious people to perform protocol rollback attacks. 8) An integer overflow error exists in the PCRE library that is used by Safari's JavaScript engine. This can potentially be exploited by malicious people to compromise a user's system. This can be exploited to cause the download file to be saved outside of the designated download directory. For more information: SA15474 11) A boundary error exists in WebKit when handling certain specially crafted content. For more information: SA15744 13) The syslog server does not properly sanitise messages before recording them. SOLUTION: Apply Security Update 2005-009. ORIGINAL ADVISORY: http://docs.info.apple.com/article.html?artnum=302847 OTHER REFERENCES: SA14530: http://secunia.com/advisories/14530/ SA16700: http://secunia.com/advisories/16700/ SA17193: http://secunia.com/advisories/17193/ SA17151: http://secunia.com/advisories/17151/ SA16502: http://secunia.com/advisories/16502/ SA15474: http://secunia.com/advisories/15474/ SA15744: http://secunia.com/advisories/15744/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-11-29 Security Update 2005-009 Security Update 2005-009 is now available and delivers the following security enhancements: Apache2 CVE-ID: CVE-2005-2088 Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.3 Impact: Cross-site scripting may be possible in certain configurations Description: The Apache 2 web server may allow an attacker to bypass protections using specially-crafted HTTP headers. This behavior is only present when Apache is used in conjunction with certain proxy servers, caching servers, or web application firewalls. This update addresses the issue by incorporating Apache version 2.0.55. Only Apache configurations that include the "SSLVerifyClient require" directive may be affected. This update address the issue by incorporating mod_ssl 2.8.24 and Apache version 2.0.55 (Mac OS X Server). CoreFoundation is used by Safari and other applications. This update addresses the issue by performing additional validation of URLs. This issue does not affect systems prior to Mac OS X v10.4. This may cause a stack buffer overflow and lead to arbitrary code execution. This update addresses the issue by performing additional validation when using NTLM authentication. This issue does not affect systems prior to Mac OS X v10.4. iodbcadmintool CVE-ID: CVE-2005-3700 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Local users may gain elevated privileges Description: The ODBC Administrator utility includes a helper tool called iodbcadmintool that executes with raised privileges. This helper tool contains a vulnerability that may allow local users to execute arbitrary commands with raised privileges. This update addresses the issue by providing an updated iodbcadmintool that is not susceptible. Such attacks may cause an SSL connection to use the SSLv2 protocol which provides less protection than SSLv3 or TLS. Further information on this issue is available at http://www.openssl.org/news/secadv_20051011.txt. This update addresses the issue by incorporating OpenSSL version 0.9.7i. passwordserver CVE-ID: CVE-2005-3701 Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.3 Impact: Local users on Open Directory master servers may gain elevated privileges Description: When creating an Open Directory master server, credentials may be compromised. This could lead to unprivileged local users gaining elevated privileges on the server. This update addresses the issue by ensuring the credentials are protected. This may lead to the execution of arbitrary code. This update addresses the issue by providing a new version of the JavaScript engine that incorporates more robust input validation. Safari CVE-ID: CVE-2005-3702 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Safari may download files outside of the designated download directory Description: When files are downloaded in Safari they are normally placed in the location specified as the download directory. However, if a web site suggests an overlong filename for a download, it is possible for Safari to create this file in other locations. Although the filename and location of the downloaded file content cannot be directly specified by remote servers, this may still lead to downloading content into locations accessible to other users. This update addresses the issue by rejecting overlong filenames. Safari CVE-ID: CVE-2005-3703 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: JavaScript dialog boxes in Safari may be misleading Description: In Safari, JavaScript dialog boxes do not indicate the web site that created them. This could mislead users into unintentionally disclosing information to a web site. This update addresses the issue by displaying the originating site name in JavaScript dialog boxes. Credit to Jakob Balle of Secunia Research for reporting this issue. This may be triggered by content downloaded from malicious web sites in applications that use WebKit such as Safari. This update addresses the issue by removing the heap overflow from WebKit. Credit to Neil Archibald of Suresec LTD and Marco Mella for reporting this issue. Although the default configuration is not vulnerable to this issue, custom sudo configurations may not properly restrict users. Further information on this issue is available from: http://www.sudo.ws/sudo/alerts/path_race.html This update addresses the issue by incorporating sudo version 1.6.8p9. syslog CVE-ID: CVE-2005-3704 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: System log entries may be forged Description: The system log server records syslog messages verbatim. By supplying control characters such as the newline character, a local attacker could forge entries with the intention to mislead the system administrator. This update addresses the issue by specially handling control characters and other non-printable characters. This issue does not affect systems prior to Mac OS X v10.4. Credit to HELIOS Software GmbH for reporting this issue. Additional Information Also included in this update are enhancements to Safari to improve handling of credit card security codes (Mac OS X v10.3.9 and Mac OS X v10.4.3), CoreTypes to improve handling of Terminal files (Mac OS X v10.4.3), QuickDraw Manager to improve rendering of PICT files (Mac OS X v10.3.9), documentation regarding OpenSSH and PAM (Mac OS X v10.4.3), and ServerMigration to remove unneeded privileges. Security Update 2005-009 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.4.3 The download file is named: "SecUpd2005-009Ti.dmg" Its SHA-1 digest is: 544f51a7bc73a57dbca95e05693904aadb2f94b1 For Mac OS X Server v10.4.3 The download file is named: "SecUpdSrvr2005-009Ti.dmg" Its SHA-1 digest is: b7620426151b8f1073c9ff73b2adf43b3086cc60 For Mac OS X v10.3.9 The download file is named: "SecUpd2005-009Pan.dmg" Its SHA-1 digest is: ea17ad7852b3e6277f53c2863e51695ac7018650 For Mac OS X Server v10.3.9 The download file is named: "SecUpdSrvr2005-009Pan.dmg" Its SHA-1 digest is: b03711729697ea8e6b683eb983343f2f3de3af13 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.1 (Build 2185) iQEVAwUBQ4zotIHaV5ucd/HdAQJiPAf/S7bsLZk3R7I8FBidCKQ/bxSxjhTFx8sK vqsVFNDsXzv+tEa3IP58D8lI8lF94o+50p59qaPWxHzl4HxPVKlH4YCiBesYmVRp FcGo0qbzj5wJzdWADPV+I8O+/CR5k8J35PuKDIzPabnO67nxoXc/DF6go50e5Hr9 Yqs2477ufq0ANd8wG9dF5pfcYwD8KRLfOmfJ9ZVhbG8Up0uO4JH71cTQZIFcKkYf g6N9SCnqx5JqCwsRx85a8WuY1x97K3zqP53/bt4Wzi76VaaSaYj01nVywworTik4 YzOWOckJmWU9+66iby9mKY2mzz+u/vwtiMp577yT4y9FiSg6yp7mWQ== =jnz9 -----END PGP SIGNATURE-----
VAR-200512-0289 CVE-2005-3702 Mac OS X and OS X Server Safari File download vulnerability CVSS V2: 5.0
CVSS V3: -
Severity: MEDIUM
Safari in Mac OS X and OS X Server 10.3.9 and 10.4.3 allows remote attackers to cause files to be downloaded to locations outside the download directory via a long file name. Safari is prone to a remote directory-traversal vulnerability. The vulnerability presents itself when a user tries to download a file from a remote location and the file name is excessively long. NOTE: This issue was previously discussed in BID 15647 (Apple Mac OS X Security Update 2005-009 Multiple Vulnerabilities), but has been assigned its own record to better document the vulnerability. For more information: SA14530 2) An error in the Apache web server's "mod_ssl" module may be exploited by malicious people to bypass certain security restrictions. For more information: SA16700 3) A boundary error exists in CoreFoundation when resolving certain URL. 4) An error in curl when handling NTLM authentication can be exploited by malicious people to compromise a user's system. For more information: SA17193 5) An error exists in the ODBC Administrator utility helper tool "iodbcadmintoo". 6) An error in OpenSSL when handling certain compatibility options can potentially be exploited by malicious people to perform protocol rollback attacks. 8) An integer overflow error exists in the PCRE library that is used by Safari's JavaScript engine. This can potentially be exploited by malicious people to compromise a user's system. This can be exploited to cause the download file to be saved outside of the designated download directory. For more information: SA15474 11) A boundary error exists in WebKit when handling certain specially crafted content. For more information: SA15744 13) The syslog server does not properly sanitise messages before recording them. SOLUTION: Apply Security Update 2005-009. ORIGINAL ADVISORY: http://docs.info.apple.com/article.html?artnum=302847 OTHER REFERENCES: SA14530: http://secunia.com/advisories/14530/ SA16700: http://secunia.com/advisories/16700/ SA17193: http://secunia.com/advisories/17193/ SA17151: http://secunia.com/advisories/17151/ SA16502: http://secunia.com/advisories/16502/ SA15474: http://secunia.com/advisories/15474/ SA15744: http://secunia.com/advisories/15744/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-11-29 Security Update 2005-009 Security Update 2005-009 is now available and delivers the following security enhancements: Apache2 CVE-ID: CVE-2005-2088 Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.3 Impact: Cross-site scripting may be possible in certain configurations Description: The Apache 2 web server may allow an attacker to bypass protections using specially-crafted HTTP headers. This behavior is only present when Apache is used in conjunction with certain proxy servers, caching servers, or web application firewalls. This update addresses the issue by incorporating Apache version 2.0.55. Only Apache configurations that include the "SSLVerifyClient require" directive may be affected. CoreFoundation CVE-ID: CVE-2005-2757 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Resolving a maliciously-crafted URL may result in crashes or arbitrary code execution Description: By carefully crafting a URL, an attacker can trigger a heap buffer overflow in CoreFoundation which may result in a crash or arbitrary code execution. CoreFoundation is used by Safari and other applications. This update addresses the issue by performing additional validation of URLs. This issue does not affect systems prior to Mac OS X v10.4. curl CVE-ID: CVE-2005-3185 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Visiting a malicious HTTP server and using NTLM authentication may result in arbitrary code execution Description: Using curl with NTLM authentication enabled to download an HTTP resource may allow an attacker to supply an overlong user or domain name. This may cause a stack buffer overflow and lead to arbitrary code execution. This update addresses the issue by performing additional validation when using NTLM authentication. This issue does not affect systems prior to Mac OS X v10.4. This helper tool contains a vulnerability that may allow local users to execute arbitrary commands with raised privileges. This update addresses the issue by providing an updated iodbcadmintool that is not susceptible. Such attacks may cause an SSL connection to use the SSLv2 protocol which provides less protection than SSLv3 or TLS. Further information on this issue is available at http://www.openssl.org/news/secadv_20051011.txt. This update addresses the issue by incorporating OpenSSL version 0.9.7i. This could lead to unprivileged local users gaining elevated privileges on the server. This update addresses the issue by ensuring the credentials are protected. This may lead to the execution of arbitrary code. This update addresses the issue by providing a new version of the JavaScript engine that incorporates more robust input validation. However, if a web site suggests an overlong filename for a download, it is possible for Safari to create this file in other locations. Although the filename and location of the downloaded file content cannot be directly specified by remote servers, this may still lead to downloading content into locations accessible to other users. This update addresses the issue by rejecting overlong filenames. This could mislead users into unintentionally disclosing information to a web site. This update addresses the issue by displaying the originating site name in JavaScript dialog boxes. Credit to Jakob Balle of Secunia Research for reporting this issue. This may be triggered by content downloaded from malicious web sites in applications that use WebKit such as Safari. This update addresses the issue by removing the heap overflow from WebKit. Credit to Neil Archibald of Suresec LTD and Marco Mella for reporting this issue. Although the default configuration is not vulnerable to this issue, custom sudo configurations may not properly restrict users. Further information on this issue is available from: http://www.sudo.ws/sudo/alerts/path_race.html This update addresses the issue by incorporating sudo version 1.6.8p9. By supplying control characters such as the newline character, a local attacker could forge entries with the intention to mislead the system administrator. This update addresses the issue by specially handling control characters and other non-printable characters. This issue does not affect systems prior to Mac OS X v10.4. Credit to HELIOS Software GmbH for reporting this issue
VAR-200512-0287 CVE-2005-3700 Mac OS X and OS X Server ODBC Administrator Unexplained execution of arbitrary code vulnerability CVSS V2: 4.6
CVSS V3: -
Severity: MEDIUM
Unknown vulnerability in iodbcadmintool in the ODBC Administrator utility in Mac OS X and OS X Server 10.3.9 and 10.4.3 allows local users to execute arbitrary code via unknown attack vectors. The 'iodbcadmintool' utility is prone to a local privilege-escalation vulnerability. This issue can allow local attackers to gain elevated privileges on an affected computer. NOTE: This issue was previously discussed in BID 15647 (Apple Mac OS X Security Update 2005-009 Multiple Vulnerabilities), but has been assigned its own record to better document the vulnerability. For more information: SA14530 2) An error in the Apache web server's "mod_ssl" module may be exploited by malicious people to bypass certain security restrictions. For more information: SA16700 3) A boundary error exists in CoreFoundation when resolving certain URL. 4) An error in curl when handling NTLM authentication can be exploited by malicious people to compromise a user's system. For more information: SA17193 5) An error exists in the ODBC Administrator utility helper tool "iodbcadmintoo". 6) An error in OpenSSL when handling certain compatibility options can potentially be exploited by malicious people to perform protocol rollback attacks. 8) An integer overflow error exists in the PCRE library that is used by Safari's JavaScript engine. This can potentially be exploited by malicious people to compromise a user's system. This can be exploited to cause the download file to be saved outside of the designated download directory. For more information: SA15474 11) A boundary error exists in WebKit when handling certain specially crafted content. For more information: SA15744 13) The syslog server does not properly sanitise messages before recording them. SOLUTION: Apply Security Update 2005-009. ORIGINAL ADVISORY: http://docs.info.apple.com/article.html?artnum=302847 OTHER REFERENCES: SA14530: http://secunia.com/advisories/14530/ SA16700: http://secunia.com/advisories/16700/ SA17193: http://secunia.com/advisories/17193/ SA17151: http://secunia.com/advisories/17151/ SA16502: http://secunia.com/advisories/16502/ SA15474: http://secunia.com/advisories/15474/ SA15744: http://secunia.com/advisories/15744/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-11-29 Security Update 2005-009 Security Update 2005-009 is now available and delivers the following security enhancements: Apache2 CVE-ID: CVE-2005-2088 Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.3 Impact: Cross-site scripting may be possible in certain configurations Description: The Apache 2 web server may allow an attacker to bypass protections using specially-crafted HTTP headers. This behavior is only present when Apache is used in conjunction with certain proxy servers, caching servers, or web application firewalls. This update addresses the issue by incorporating Apache version 2.0.55. Only Apache configurations that include the "SSLVerifyClient require" directive may be affected. This update address the issue by incorporating mod_ssl 2.8.24 and Apache version 2.0.55 (Mac OS X Server). CoreFoundation is used by Safari and other applications. This update addresses the issue by performing additional validation of URLs. This issue does not affect systems prior to Mac OS X v10.4. This may cause a stack buffer overflow and lead to arbitrary code execution. This update addresses the issue by performing additional validation when using NTLM authentication. This issue does not affect systems prior to Mac OS X v10.4. This helper tool contains a vulnerability that may allow local users to execute arbitrary commands with raised privileges. This update addresses the issue by providing an updated iodbcadmintool that is not susceptible. Such attacks may cause an SSL connection to use the SSLv2 protocol which provides less protection than SSLv3 or TLS. Further information on this issue is available at http://www.openssl.org/news/secadv_20051011.txt. This update addresses the issue by incorporating OpenSSL version 0.9.7i. This update addresses the issue by ensuring the credentials are protected. This may lead to the execution of arbitrary code. This update addresses the issue by providing a new version of the JavaScript engine that incorporates more robust input validation. However, if a web site suggests an overlong filename for a download, it is possible for Safari to create this file in other locations. Although the filename and location of the downloaded file content cannot be directly specified by remote servers, this may still lead to downloading content into locations accessible to other users. This update addresses the issue by rejecting overlong filenames. Safari CVE-ID: CVE-2005-3703 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: JavaScript dialog boxes in Safari may be misleading Description: In Safari, JavaScript dialog boxes do not indicate the web site that created them. This could mislead users into unintentionally disclosing information to a web site. This update addresses the issue by displaying the originating site name in JavaScript dialog boxes. Credit to Jakob Balle of Secunia Research for reporting this issue. This may be triggered by content downloaded from malicious web sites in applications that use WebKit such as Safari. This update addresses the issue by removing the heap overflow from WebKit. Credit to Neil Archibald of Suresec LTD and Marco Mella for reporting this issue. Although the default configuration is not vulnerable to this issue, custom sudo configurations may not properly restrict users. Further information on this issue is available from: http://www.sudo.ws/sudo/alerts/path_race.html This update addresses the issue by incorporating sudo version 1.6.8p9. syslog CVE-ID: CVE-2005-3704 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: System log entries may be forged Description: The system log server records syslog messages verbatim. By supplying control characters such as the newline character, a local attacker could forge entries with the intention to mislead the system administrator. This update addresses the issue by specially handling control characters and other non-printable characters. This issue does not affect systems prior to Mac OS X v10.4. Credit to HELIOS Software GmbH for reporting this issue. Additional Information Also included in this update are enhancements to Safari to improve handling of credit card security codes (Mac OS X v10.3.9 and Mac OS X v10.4.3), CoreTypes to improve handling of Terminal files (Mac OS X v10.4.3), QuickDraw Manager to improve rendering of PICT files (Mac OS X v10.3.9), documentation regarding OpenSSH and PAM (Mac OS X v10.4.3), and ServerMigration to remove unneeded privileges. Security Update 2005-009 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.4.3 The download file is named: "SecUpd2005-009Ti.dmg" Its SHA-1 digest is: 544f51a7bc73a57dbca95e05693904aadb2f94b1 For Mac OS X Server v10.4.3 The download file is named: "SecUpdSrvr2005-009Ti.dmg" Its SHA-1 digest is: b7620426151b8f1073c9ff73b2adf43b3086cc60 For Mac OS X v10.3.9 The download file is named: "SecUpd2005-009Pan.dmg" Its SHA-1 digest is: ea17ad7852b3e6277f53c2863e51695ac7018650 For Mac OS X Server v10.3.9 The download file is named: "SecUpdSrvr2005-009Pan.dmg" Its SHA-1 digest is: b03711729697ea8e6b683eb983343f2f3de3af13 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.1 (Build 2185) iQEVAwUBQ4zotIHaV5ucd/HdAQJiPAf/S7bsLZk3R7I8FBidCKQ/bxSxjhTFx8sK vqsVFNDsXzv+tEa3IP58D8lI8lF94o+50p59qaPWxHzl4HxPVKlH4YCiBesYmVRp FcGo0qbzj5wJzdWADPV+I8O+/CR5k8J35PuKDIzPabnO67nxoXc/DF6go50e5Hr9 Yqs2477ufq0ANd8wG9dF5pfcYwD8KRLfOmfJ9ZVhbG8Up0uO4JH71cTQZIFcKkYf g6N9SCnqx5JqCwsRx85a8WuY1x97K3zqP53/bt4Wzi76VaaSaYj01nVywworTik4 YzOWOckJmWU9+66iby9mKY2mzz+u/vwtiMp577yT4y9FiSg6yp7mWQ== =jnz9 -----END PGP SIGNATURE-----
VAR-200512-0291 CVE-2005-3704 Mac OS X and OS X Server Syslog server message spoofing vulnerability CVSS V2: 5.0
CVSS V3: -
Severity: MEDIUM
System log server in Mac OS X and OS X Server 10.4 through 10.4.3 allows remote attackers to spoof syslog messages in log files by injecting various control characters such as newline (NL). Apple has released Security Update 2005-008 to address multiple Mac OS X local and remote vulnerabilities. NOTE: This BID is being retired because the issues are now documented in the following individual records: 16882 Apple Mac OS X CoreFoundation Remote Buffer Overflow Vulnerability 16903 Apple Mac OS X Iodbcadmintool Local Privilege Escalation Vulnerability 16904 Apple Mac OS X Passwordserver Local Privilege Escalation Vulnerability 16926 Apple Safari Remote Directory Traversal Vulnerability 29011 Apple Safari WebKit Unspecified Heap Overflow Vulnerability 14106 Apache HTTP Request Smuggling Vulnerability 14721 Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability 15102 Multiple Vendor WGet/Curl NTLM Username Buffer Overflow Vulnerability 15071 OpenSSL Insecure Protocol Negotiation Weakness 14620 PCRE Regular Expression Heap Overflow Vulnerability 14011 Apple Safari Dialog Box Origin Spoofing Vulnerability 13993 Todd Miller Sudo Local Race Condition Vulnerability. For more information: SA14530 2) An error in the Apache web server's "mod_ssl" module may be exploited by malicious people to bypass certain security restrictions. For more information: SA16700 3) A boundary error exists in CoreFoundation when resolving certain URL. 4) An error in curl when handling NTLM authentication can be exploited by malicious people to compromise a user's system. For more information: SA17193 5) An error exists in the ODBC Administrator utility helper tool "iodbcadmintoo". 6) An error in OpenSSL when handling certain compatibility options can potentially be exploited by malicious people to perform protocol rollback attacks. 8) An integer overflow error exists in the PCRE library that is used by Safari's JavaScript engine. This can potentially be exploited by malicious people to compromise a user's system. This can be exploited to cause the download file to be saved outside of the designated download directory. For more information: SA15474 11) A boundary error exists in WebKit when handling certain specially crafted content. For more information: SA15744 13) The syslog server does not properly sanitise messages before recording them. SOLUTION: Apply Security Update 2005-009. ORIGINAL ADVISORY: http://docs.info.apple.com/article.html?artnum=302847 OTHER REFERENCES: SA14530: http://secunia.com/advisories/14530/ SA16700: http://secunia.com/advisories/16700/ SA17193: http://secunia.com/advisories/17193/ SA17151: http://secunia.com/advisories/17151/ SA16502: http://secunia.com/advisories/16502/ SA15474: http://secunia.com/advisories/15474/ SA15744: http://secunia.com/advisories/15744/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-11-29 Security Update 2005-009 Security Update 2005-009 is now available and delivers the following security enhancements: Apache2 CVE-ID: CVE-2005-2088 Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.3 Impact: Cross-site scripting may be possible in certain configurations Description: The Apache 2 web server may allow an attacker to bypass protections using specially-crafted HTTP headers. This behavior is only present when Apache is used in conjunction with certain proxy servers, caching servers, or web application firewalls. This update addresses the issue by incorporating Apache version 2.0.55. Only Apache configurations that include the "SSLVerifyClient require" directive may be affected. CoreFoundation CVE-ID: CVE-2005-2757 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Resolving a maliciously-crafted URL may result in crashes or arbitrary code execution Description: By carefully crafting a URL, an attacker can trigger a heap buffer overflow in CoreFoundation which may result in a crash or arbitrary code execution. CoreFoundation is used by Safari and other applications. This update addresses the issue by performing additional validation of URLs. This issue does not affect systems prior to Mac OS X v10.4. curl CVE-ID: CVE-2005-3185 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Visiting a malicious HTTP server and using NTLM authentication may result in arbitrary code execution Description: Using curl with NTLM authentication enabled to download an HTTP resource may allow an attacker to supply an overlong user or domain name. This may cause a stack buffer overflow and lead to arbitrary code execution. This update addresses the issue by performing additional validation when using NTLM authentication. This issue does not affect systems prior to Mac OS X v10.4. iodbcadmintool CVE-ID: CVE-2005-3700 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Local users may gain elevated privileges Description: The ODBC Administrator utility includes a helper tool called iodbcadmintool that executes with raised privileges. This helper tool contains a vulnerability that may allow local users to execute arbitrary commands with raised privileges. This update addresses the issue by providing an updated iodbcadmintool that is not susceptible. Such attacks may cause an SSL connection to use the SSLv2 protocol which provides less protection than SSLv3 or TLS. Further information on this issue is available at http://www.openssl.org/news/secadv_20051011.txt. This update addresses the issue by incorporating OpenSSL version 0.9.7i. passwordserver CVE-ID: CVE-2005-3701 Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.3 Impact: Local users on Open Directory master servers may gain elevated privileges Description: When creating an Open Directory master server, credentials may be compromised. This could lead to unprivileged local users gaining elevated privileges on the server. This update addresses the issue by ensuring the credentials are protected. Safari CVE-ID: CVE-2005-2491 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Processing a regular expressions may result in arbitrary code execution Description: The JavaScript engine in Safari uses a version of the PCRE library that is vulnerable to a potentially exploitable heap overflow. This may lead to the execution of arbitrary code. This update addresses the issue by providing a new version of the JavaScript engine that incorporates more robust input validation. However, if a web site suggests an overlong filename for a download, it is possible for Safari to create this file in other locations. Although the filename and location of the downloaded file content cannot be directly specified by remote servers, this may still lead to downloading content into locations accessible to other users. This update addresses the issue by rejecting overlong filenames. Safari CVE-ID: CVE-2005-3703 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: JavaScript dialog boxes in Safari may be misleading Description: In Safari, JavaScript dialog boxes do not indicate the web site that created them. This could mislead users into unintentionally disclosing information to a web site. This update addresses the issue by displaying the originating site name in JavaScript dialog boxes. Credit to Jakob Balle of Secunia Research for reporting this issue. Safari CVE-ID: CVE-2005-3705 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Visiting malicious web sites with WebKit-based applications may lead to arbitrary code execution Description: WebKit contains a heap overflow that may lead to the execution of arbitrary code. This may be triggered by content downloaded from malicious web sites in applications that use WebKit such as Safari. This update addresses the issue by removing the heap overflow from WebKit. Credit to Neil Archibald of Suresec LTD and Marco Mella for reporting this issue. Although the default configuration is not vulnerable to this issue, custom sudo configurations may not properly restrict users. Further information on this issue is available from: http://www.sudo.ws/sudo/alerts/path_race.html This update addresses the issue by incorporating sudo version 1.6.8p9. By supplying control characters such as the newline character, a local attacker could forge entries with the intention to mislead the system administrator. This update addresses the issue by specially handling control characters and other non-printable characters. This issue does not affect systems prior to Mac OS X v10.4. Credit to HELIOS Software GmbH for reporting this issue. Additional Information Also included in this update are enhancements to Safari to improve handling of credit card security codes (Mac OS X v10.3.9 and Mac OS X v10.4.3), CoreTypes to improve handling of Terminal files (Mac OS X v10.4.3), QuickDraw Manager to improve rendering of PICT files (Mac OS X v10.3.9), documentation regarding OpenSSH and PAM (Mac OS X v10.4.3), and ServerMigration to remove unneeded privileges. Security Update 2005-009 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.4.3 The download file is named: "SecUpd2005-009Ti.dmg" Its SHA-1 digest is: 544f51a7bc73a57dbca95e05693904aadb2f94b1 For Mac OS X Server v10.4.3 The download file is named: "SecUpdSrvr2005-009Ti.dmg" Its SHA-1 digest is: b7620426151b8f1073c9ff73b2adf43b3086cc60 For Mac OS X v10.3.9 The download file is named: "SecUpd2005-009Pan.dmg" Its SHA-1 digest is: ea17ad7852b3e6277f53c2863e51695ac7018650 For Mac OS X Server v10.3.9 The download file is named: "SecUpdSrvr2005-009Pan.dmg" Its SHA-1 digest is: b03711729697ea8e6b683eb983343f2f3de3af13 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.1 (Build 2185) iQEVAwUBQ4zotIHaV5ucd/HdAQJiPAf/S7bsLZk3R7I8FBidCKQ/bxSxjhTFx8sK vqsVFNDsXzv+tEa3IP58D8lI8lF94o+50p59qaPWxHzl4HxPVKlH4YCiBesYmVRp FcGo0qbzj5wJzdWADPV+I8O+/CR5k8J35PuKDIzPabnO67nxoXc/DF6go50e5Hr9 Yqs2477ufq0ANd8wG9dF5pfcYwD8KRLfOmfJ9ZVhbG8Up0uO4JH71cTQZIFcKkYf g6N9SCnqx5JqCwsRx85a8WuY1x97K3zqP53/bt4Wzi76VaaSaYj01nVywworTik4 YzOWOckJmWU9+66iby9mKY2mzz+u/vwtiMp577yT4y9FiSg6yp7mWQ== =jnz9 -----END PGP SIGNATURE-----
VAR-200512-0292 CVE-2005-3705 Apple Mac OS X Security hole CVSS V2: 7.5
CVSS V3: -
Severity: HIGH
Heap-based buffer overflow in WebKit in Mac OS X and OS X Server 10.3.9 and 10.4.3, as used in applications such as Safari, allows remote attackers to execute arbitrary code via unknown attack vectors. Apple Safari is prone to a heap-overflow vulnerability. Attackers may exploit this issue to execute arbitrary code or to crash the affected application. Other attacks are also possible. For more information: SA14530 2) An error in the Apache web server's "mod_ssl" module may be exploited by malicious people to bypass certain security restrictions. For more information: SA16700 3) A boundary error exists in CoreFoundation when resolving certain URL. 4) An error in curl when handling NTLM authentication can be exploited by malicious people to compromise a user's system. For more information: SA17193 5) An error exists in the ODBC Administrator utility helper tool "iodbcadmintoo". 6) An error in OpenSSL when handling certain compatibility options can potentially be exploited by malicious people to perform protocol rollback attacks. 8) An integer overflow error exists in the PCRE library that is used by Safari's JavaScript engine. This can potentially be exploited by malicious people to compromise a user's system. This can be exploited to cause the download file to be saved outside of the designated download directory. For more information: SA15474 11) A boundary error exists in WebKit when handling certain specially crafted content. For more information: SA15744 13) The syslog server does not properly sanitise messages before recording them. SOLUTION: Apply Security Update 2005-009. ORIGINAL ADVISORY: http://docs.info.apple.com/article.html?artnum=302847 OTHER REFERENCES: SA14530: http://secunia.com/advisories/14530/ SA16700: http://secunia.com/advisories/16700/ SA17193: http://secunia.com/advisories/17193/ SA17151: http://secunia.com/advisories/17151/ SA16502: http://secunia.com/advisories/16502/ SA15474: http://secunia.com/advisories/15474/ SA15744: http://secunia.com/advisories/15744/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-11-29 Security Update 2005-009 Security Update 2005-009 is now available and delivers the following security enhancements: Apache2 CVE-ID: CVE-2005-2088 Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.3 Impact: Cross-site scripting may be possible in certain configurations Description: The Apache 2 web server may allow an attacker to bypass protections using specially-crafted HTTP headers. This behavior is only present when Apache is used in conjunction with certain proxy servers, caching servers, or web application firewalls. This update addresses the issue by incorporating Apache version 2.0.55. Only Apache configurations that include the "SSLVerifyClient require" directive may be affected. CoreFoundation is used by Safari and other applications. This update addresses the issue by performing additional validation of URLs. This may cause a stack buffer overflow and lead to arbitrary code execution. This update addresses the issue by performing additional validation when using NTLM authentication. This helper tool contains a vulnerability that may allow local users to execute arbitrary commands with raised privileges. This update addresses the issue by providing an updated iodbcadmintool that is not susceptible. Such attacks may cause an SSL connection to use the SSLv2 protocol which provides less protection than SSLv3 or TLS. Further information on this issue is available at http://www.openssl.org/news/secadv_20051011.txt. This update addresses the issue by incorporating OpenSSL version 0.9.7i. passwordserver CVE-ID: CVE-2005-3701 Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.3 Impact: Local users on Open Directory master servers may gain elevated privileges Description: When creating an Open Directory master server, credentials may be compromised. This could lead to unprivileged local users gaining elevated privileges on the server. This update addresses the issue by ensuring the credentials are protected. This may lead to the execution of arbitrary code. This update addresses the issue by providing a new version of the JavaScript engine that incorporates more robust input validation. However, if a web site suggests an overlong filename for a download, it is possible for Safari to create this file in other locations. Although the filename and location of the downloaded file content cannot be directly specified by remote servers, this may still lead to downloading content into locations accessible to other users. This update addresses the issue by rejecting overlong filenames. This could mislead users into unintentionally disclosing information to a web site. This update addresses the issue by displaying the originating site name in JavaScript dialog boxes. Credit to Jakob Balle of Secunia Research for reporting this issue. This may be triggered by content downloaded from malicious web sites in applications that use WebKit such as Safari. This update addresses the issue by removing the heap overflow from WebKit. Credit to Neil Archibald of Suresec LTD and Marco Mella for reporting this issue. Although the default configuration is not vulnerable to this issue, custom sudo configurations may not properly restrict users. Further information on this issue is available from: http://www.sudo.ws/sudo/alerts/path_race.html This update addresses the issue by incorporating sudo version 1.6.8p9. By supplying control characters such as the newline character, a local attacker could forge entries with the intention to mislead the system administrator. This update addresses the issue by specially handling control characters and other non-printable characters. Credit to HELIOS Software GmbH for reporting this issue. Security Update 2005-009 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.4.3 The download file is named: "SecUpd2005-009Ti.dmg" Its SHA-1 digest is: 544f51a7bc73a57dbca95e05693904aadb2f94b1 For Mac OS X Server v10.4.3 The download file is named: "SecUpdSrvr2005-009Ti.dmg" Its SHA-1 digest is: b7620426151b8f1073c9ff73b2adf43b3086cc60 For Mac OS X v10.3.9 The download file is named: "SecUpd2005-009Pan.dmg" Its SHA-1 digest is: ea17ad7852b3e6277f53c2863e51695ac7018650 For Mac OS X Server v10.3.9 The download file is named: "SecUpdSrvr2005-009Pan.dmg" Its SHA-1 digest is: b03711729697ea8e6b683eb983343f2f3de3af13 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.1 (Build 2185) iQEVAwUBQ4zotIHaV5ucd/HdAQJiPAf/S7bsLZk3R7I8FBidCKQ/bxSxjhTFx8sK vqsVFNDsXzv+tEa3IP58D8lI8lF94o+50p59qaPWxHzl4HxPVKlH4YCiBesYmVRp FcGo0qbzj5wJzdWADPV+I8O+/CR5k8J35PuKDIzPabnO67nxoXc/DF6go50e5Hr9 Yqs2477ufq0ANd8wG9dF5pfcYwD8KRLfOmfJ9ZVhbG8Up0uO4JH71cTQZIFcKkYf g6N9SCnqx5JqCwsRx85a8WuY1x97K3zqP53/bt4Wzi76VaaSaYj01nVywworTik4 YzOWOckJmWU9+66iby9mKY2mzz+u/vwtiMp577yT4y9FiSg6yp7mWQ== =jnz9 -----END PGP SIGNATURE-----
VAR-200512-0288 CVE-2005-3701 Mac OS X Server passwordserver Unknown privilege escalation vulnerability CVSS V2: 7.2
CVSS V3: -
Severity: HIGH
Unspecified vulnerability in passwordserver in Mac OS X Server 10.3.9 and 10.4.3, when creating an Open Directory master server, allows local users to gain privileges via unknown attack vectors. The 'passwordserver' tool is prone to a local privilege-escalation vulnerability. NOTE: This issue was previously discussed in BID 15647 (Apple Mac OS X Security Update 2005-009 Multiple Vulnerabilities), but has been assigned its own record to better document the vulnerability. For more information: SA14530 2) An error in the Apache web server's "mod_ssl" module may be exploited by malicious people to bypass certain security restrictions. For more information: SA16700 3) A boundary error exists in CoreFoundation when resolving certain URL. 4) An error in curl when handling NTLM authentication can be exploited by malicious people to compromise a user's system. For more information: SA17193 5) An error exists in the ODBC Administrator utility helper tool "iodbcadmintoo". 6) An error in OpenSSL when handling certain compatibility options can potentially be exploited by malicious people to perform protocol rollback attacks. 8) An integer overflow error exists in the PCRE library that is used by Safari's JavaScript engine. This can potentially be exploited by malicious people to compromise a user's system. This can be exploited to cause the download file to be saved outside of the designated download directory. For more information: SA15474 11) A boundary error exists in WebKit when handling certain specially crafted content. For more information: SA15744 13) The syslog server does not properly sanitise messages before recording them. SOLUTION: Apply Security Update 2005-009. ORIGINAL ADVISORY: http://docs.info.apple.com/article.html?artnum=302847 OTHER REFERENCES: SA14530: http://secunia.com/advisories/14530/ SA16700: http://secunia.com/advisories/16700/ SA17193: http://secunia.com/advisories/17193/ SA17151: http://secunia.com/advisories/17151/ SA16502: http://secunia.com/advisories/16502/ SA15474: http://secunia.com/advisories/15474/ SA15744: http://secunia.com/advisories/15744/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-11-29 Security Update 2005-009 Security Update 2005-009 is now available and delivers the following security enhancements: Apache2 CVE-ID: CVE-2005-2088 Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.3 Impact: Cross-site scripting may be possible in certain configurations Description: The Apache 2 web server may allow an attacker to bypass protections using specially-crafted HTTP headers. This behavior is only present when Apache is used in conjunction with certain proxy servers, caching servers, or web application firewalls. This update addresses the issue by incorporating Apache version 2.0.55. apache_mod_ssl CVE-ID: CVE-2005-2700 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: SSL client authentication may be bypassed in certain configurations Description: The Apache web server's mod_ssl module may allow an attacker unauthorized access to a resource that is configured to require SSL client authentication. Only Apache configurations that include the "SSLVerifyClient require" directive may be affected. This update address the issue by incorporating mod_ssl 2.8.24 and Apache version 2.0.55 (Mac OS X Server). CoreFoundation CVE-ID: CVE-2005-2757 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Resolving a maliciously-crafted URL may result in crashes or arbitrary code execution Description: By carefully crafting a URL, an attacker can trigger a heap buffer overflow in CoreFoundation which may result in a crash or arbitrary code execution. CoreFoundation is used by Safari and other applications. This update addresses the issue by performing additional validation of URLs. This issue does not affect systems prior to Mac OS X v10.4. curl CVE-ID: CVE-2005-3185 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Visiting a malicious HTTP server and using NTLM authentication may result in arbitrary code execution Description: Using curl with NTLM authentication enabled to download an HTTP resource may allow an attacker to supply an overlong user or domain name. This may cause a stack buffer overflow and lead to arbitrary code execution. This update addresses the issue by performing additional validation when using NTLM authentication. This issue does not affect systems prior to Mac OS X v10.4. This helper tool contains a vulnerability that may allow local users to execute arbitrary commands with raised privileges. This update addresses the issue by providing an updated iodbcadmintool that is not susceptible. OpenSSL CVE-ID: CVE-2005-2969 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Applications using OpenSSL may be forced to use the weaker SSLv2 protocol Description: Applications that do not disable SSLv2 or that enable certain compatibility options when using OpenSSL may be vulnerable to a protocol downgrade attack. Such attacks may cause an SSL connection to use the SSLv2 protocol which provides less protection than SSLv3 or TLS. Further information on this issue is available at http://www.openssl.org/news/secadv_20051011.txt. This update addresses the issue by incorporating OpenSSL version 0.9.7i. This update addresses the issue by ensuring the credentials are protected. Safari CVE-ID: CVE-2005-2491 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Processing a regular expressions may result in arbitrary code execution Description: The JavaScript engine in Safari uses a version of the PCRE library that is vulnerable to a potentially exploitable heap overflow. This may lead to the execution of arbitrary code. This update addresses the issue by providing a new version of the JavaScript engine that incorporates more robust input validation. Safari CVE-ID: CVE-2005-3702 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Safari may download files outside of the designated download directory Description: When files are downloaded in Safari they are normally placed in the location specified as the download directory. However, if a web site suggests an overlong filename for a download, it is possible for Safari to create this file in other locations. Although the filename and location of the downloaded file content cannot be directly specified by remote servers, this may still lead to downloading content into locations accessible to other users. This update addresses the issue by rejecting overlong filenames. Safari CVE-ID: CVE-2005-3703 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: JavaScript dialog boxes in Safari may be misleading Description: In Safari, JavaScript dialog boxes do not indicate the web site that created them. This could mislead users into unintentionally disclosing information to a web site. This update addresses the issue by displaying the originating site name in JavaScript dialog boxes. Credit to Jakob Balle of Secunia Research for reporting this issue. Safari CVE-ID: CVE-2005-3705 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Visiting malicious web sites with WebKit-based applications may lead to arbitrary code execution Description: WebKit contains a heap overflow that may lead to the execution of arbitrary code. This may be triggered by content downloaded from malicious web sites in applications that use WebKit such as Safari. This update addresses the issue by removing the heap overflow from WebKit. Credit to Neil Archibald of Suresec LTD and Marco Mella for reporting this issue. Although the default configuration is not vulnerable to this issue, custom sudo configurations may not properly restrict users. Further information on this issue is available from: http://www.sudo.ws/sudo/alerts/path_race.html This update addresses the issue by incorporating sudo version 1.6.8p9. syslog CVE-ID: CVE-2005-3704 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: System log entries may be forged Description: The system log server records syslog messages verbatim. By supplying control characters such as the newline character, a local attacker could forge entries with the intention to mislead the system administrator. This update addresses the issue by specially handling control characters and other non-printable characters. This issue does not affect systems prior to Mac OS X v10.4. Credit to HELIOS Software GmbH for reporting this issue. Additional Information Also included in this update are enhancements to Safari to improve handling of credit card security codes (Mac OS X v10.3.9 and Mac OS X v10.4.3), CoreTypes to improve handling of Terminal files (Mac OS X v10.4.3), QuickDraw Manager to improve rendering of PICT files (Mac OS X v10.3.9), documentation regarding OpenSSH and PAM (Mac OS X v10.4.3), and ServerMigration to remove unneeded privileges. Security Update 2005-009 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.4.3 The download file is named: "SecUpd2005-009Ti.dmg" Its SHA-1 digest is: 544f51a7bc73a57dbca95e05693904aadb2f94b1 For Mac OS X Server v10.4.3 The download file is named: "SecUpdSrvr2005-009Ti.dmg" Its SHA-1 digest is: b7620426151b8f1073c9ff73b2adf43b3086cc60 For Mac OS X v10.3.9 The download file is named: "SecUpd2005-009Pan.dmg" Its SHA-1 digest is: ea17ad7852b3e6277f53c2863e51695ac7018650 For Mac OS X Server v10.3.9 The download file is named: "SecUpdSrvr2005-009Pan.dmg" Its SHA-1 digest is: b03711729697ea8e6b683eb983343f2f3de3af13 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.1 (Build 2185) iQEVAwUBQ4zotIHaV5ucd/HdAQJiPAf/S7bsLZk3R7I8FBidCKQ/bxSxjhTFx8sK vqsVFNDsXzv+tEa3IP58D8lI8lF94o+50p59qaPWxHzl4HxPVKlH4YCiBesYmVRp FcGo0qbzj5wJzdWADPV+I8O+/CR5k8J35PuKDIzPabnO67nxoXc/DF6go50e5Hr9 Yqs2477ufq0ANd8wG9dF5pfcYwD8KRLfOmfJ9ZVhbG8Up0uO4JH71cTQZIFcKkYf g6N9SCnqx5JqCwsRx85a8WuY1x97K3zqP53/bt4Wzi76VaaSaYj01nVywworTik4 YzOWOckJmWU9+66iby9mKY2mzz+u/vwtiMp577yT4y9FiSg6yp7mWQ== =jnz9 -----END PGP SIGNATURE-----
VAR-200507-0224 CVE-2005-2272 Apple Safari Dialog spoofing vulnerability CVSS V2: 2.6
CVSS V3: -
Severity: LOW
Safari version 2.0 (412) does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability.". An attacker may exploit this vulnerability to spoof an interface of a trusted web site. This issue may allow a remote attacker to carry out phishing style attacks. Safari is Apple's answer to browser software. TITLE: Mac OS X Security Update Fixes Multiple Vulnerabilities SECUNIA ADVISORY ID: SA17813 VERIFY ADVISORY: http://secunia.com/advisories/17813/ CRITICAL: Highly critical IMPACT: Security Bypass, Cross Site Scripting, Spoofing, Manipulation of data, Exposure of sensitive information, Privilege escalation, DoS, System access WHERE: >From remote OPERATING SYSTEM: Apple Macintosh OS X http://secunia.com/product/96/ DESCRIPTION: Apple has issued a security update for Mac OS X, which fixes 13 vulnerabilities. 1) An error in the handling of HTTP headers in the Apache 2 web server can be exploited by malicious people to conduct HTTP request smuggling attacks when Apache is used in conjunction with certain proxy servers, caching servers, or web application firewalls. For more information: SA14530 2) An error in the Apache web server's "mod_ssl" module may be exploited by malicious people to bypass certain security restrictions. For more information: SA16700 3) A boundary error exists in CoreFoundation when resolving certain URL. This can be exploited to cause a heap-based buffer overflow and may allow arbitrary code execution via a specially-crafted URL. CoreFoundation is used by Safari and other applications. 4) An error in curl when handling NTLM authentication can be exploited by malicious people to compromise a user's system. For more information: SA17193 5) An error exists in the ODBC Administrator utility helper tool "iodbcadmintoo". This can be exploited by malicious, local users to execute commands with escalated privileges. 6) An error in OpenSSL when handling certain compatibility options can potentially be exploited by malicious people to perform protocol rollback attacks. For more information: SA17151 7) An error in the passwordserver when handling the creation of an Open Directory master server may cause certain credentials to be disclosed. This can be exploited by unprivileged local users to gain elevated privileges on the server. 8) An integer overflow error exists in the PCRE library that is used by Safari's JavaScript engine. This can potentially be exploited by malicious people to compromise a user's system. For more information: SA16502 9) An error exists in Safari when saving a downloaded file with an overly long filename. This can be exploited to cause the download file to be saved outside of the designated download directory. 10) JavaScript dialog boxes in Safari do not indicate the web site that created them. For more information: SA15474 11) A boundary error exists in WebKit when handling certain specially crafted content. This can be exploited to cause a heap-based buffer overflow via content downloaded from malicious web sites in applications that use WebKit such as Safari. 12) An error in sudo can be exploited by malicious, local users to execute arbitrary commands with escalated privileges. For more information: SA15744 13) The syslog server does not properly sanitise messages before recording them. This can be exploited to forge log entries and mislead the system administrator by supplying messages certaining control characters, such as the newline character, to the syslog server. SOLUTION: Apply Security Update 2005-009. Mac OS X 10.3.9 Client (Panther): http://www.apple.com/support/downloads/securityupdate2005009pantherclient.html Mac OS X 10.3.9 Server (Panther): http://www.apple.com/support/downloads/securityupdate2005009pantherserver.html Mac OS X 10.4.3 Client (Tiger): http://www.apple.com/support/downloads/securityupdate2005009tigerclient.html Mac OS X 10.4.3 Server (Tiger): http://www.apple.com/support/downloads/securityupdate2005009tigerserver.html PROVIDED AND/OR DISCOVERED BY: 10) Jakob Balle, Secunia Research. 11) Neil Archibald, Suresec LTD and Marco Mella. 13) HELIOS Software GmbH. ORIGINAL ADVISORY: http://docs.info.apple.com/article.html?artnum=302847 OTHER REFERENCES: SA14530: http://secunia.com/advisories/14530/ SA16700: http://secunia.com/advisories/16700/ SA17193: http://secunia.com/advisories/17193/ SA17151: http://secunia.com/advisories/17151/ SA16502: http://secunia.com/advisories/16502/ SA15474: http://secunia.com/advisories/15474/ SA15744: http://secunia.com/advisories/15744/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . ---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: Safari Dialog Origin Spoofing Vulnerability SECUNIA ADVISORY ID: SA15474 VERIFY ADVISORY: http://secunia.com/advisories/15474/ CRITICAL: Less critical IMPACT: Spoofing WHERE: >From remote SOFTWARE: Safari 1.x http://secunia.com/product/1543/ DESCRIPTION: Secunia Research has discovered a vulnerability in Safari, which can be exploited by malicious web sites to spoof dialog boxes. The problem is that JavaScript dialog boxes do not display or include their origin, which allows a new window to open e.g. Secunia has constructed a test, which can be used to check if your browser is affected by this issue: http://secunia.com/multiple_browsers_dialog_origin_vulnerability_test/ The vulnerability has been confirmed in version 2.0 (412). Prior versions may also be affected. SOLUTION: Do not browse untrusted web sites while browsing trusted sites
VAR-200506-0141 CVE-2005-2025 Cisco IOS and Cisco PIX Firewall In VPN Vulnerability to get group name CVSS V2: 5.0
CVSS V3: -
Severity: MEDIUM
Cisco VPN 3000 Concentrator before 4.1.7.F allows remote attackers to determine valid groupnames by sending an IKE Aggressive Mode packet with the groupname in the ID field, which generates a response if the groupname is valid, but does not generate a response for an invalid groupname. Cisco IOS and Cisco PIX Firewall In IKE Valid group names in aggressive mode messages / There are vulnerabilities whose responses differ depending on the invalidity. In addition, there is a vulnerability that can analyze the hash value from the response when requesting a valid group name.A valid group name and password hash may be obtained. Cisco VPN Concentrator is affected by a remote groupname enumeration weakness. This issue is due to a design error that could assist a remote attacker in enumerating groupnames. Reportedly, once the attacker has verified a groupname they can obtain a password hash from an affected device and carry out bruteforce attacks against the password hash. A valid groupname and password pair can allow the attacker to complete IKE Phase-1 authentication and carry out man-in-the-middle attacks against other users. This may ultimately allow the attacker to gain unauthorized access to the network. All Cisco VPN Concentrator 3000 series products running groupname authentication are considered vulnerable to this issue. This issue is tracked by the following Cisco BUG IDs: CSCeg00323, CSCsb38075, and CSCsf25725 - for the Cisco VPN 3000 Series Concentrators CSCei29901 - for the Cisco PIX 500 Series Security Appliances running code version 7.x CSCei51783 - for the Cisco ASA 5500 Series Adaptive Security Appliances running code version 7.x CSCsb26495 and CSCsb33172 - for Cisco IOS® software. Cisco VPN series hubs consist of a general-purpose remote access virtual private network (VPN) platform and client software that combines high availability, performance, and scalability with today's most advanced encryption and authentication technologies, providing professional operators with or enterprise users to provide services. A remote group name enumeration vulnerability exists in Cisco VPN hubs that could allow an attacker to use a dictionary program to determine valid group names on the hub